The desk ledger — honesty without deficit language

AGENTS.md

@@ -56,9 +56,9 @@ to check the repo's claims. The harnesses run the real engine, so they need one
 10. **Anything PENDING says PENDING.** Never estimate, never round, never ship a vibe.
 11. **PAPER.md and the in-app paper view are twins.** Edit both or neither; the page
    reads its §5–§6 numbers live from the ledger, the file cites regeneration
-   commands — neither hand-writes a measured number. The Why page's scope ledger
-   follows the same rule: it states what shipped, what is simulated, what is
-   missing — and stays true.
+   commands — neither hand-writes a measured number. The Why page's desk
+   ledger follows the same rule: it states what shipped, what is simulated,
+   and the work order for what comes next — and stays true.
 
 ## How to add things
 

ARCHITECTURE.md

@@ -58,7 +58,7 @@ surfaces halves both, and the ledger keeps them coherent.
 
 | # | Decision | Rationale | Status |
 |---|---|---|---|
-| 1 | Payment mechanism: (A) tokenized charge → (B) hosted-checkout completion → (C) labeled simulation | A is the true agent payment; B is real rails; C never silent. Shipped default is C until test keys arrive; A/B code is present and keyed off env | **blocked-no-keys, code ready** (`results/d1_1_spike.json`) |
+| 1 | Payment mechanism: (A) tokenized charge → (B) hosted-checkout completion → (C) labeled simulation | A is the true agent payment; B is real rails; C never silent. B is live on test keys; C is the no-keys fallback; A/B/C keyed off env | **B live · C fallback** (`results/d1_1_spike.json`) |
 | 2 | Ed25519 for mandate signatures | small keys, async verification, no shared secret between buyer↔merchant (HMAC implies a trust model we don't have) | locked |
 | 3 | JSONL ledger instead of SQLite/ORM | the brief's bar is "show the audit trail" — here the audit trail IS the database; `head data/state/ledger.jsonl` is a debugging command; zero native deps; the chain gives tamper evidence an ORM doesn't. Writers re-read the file before every append/read — concurrent instances converge, never fork (incident D5-1, pinned by `make test`) | locked (logged D1-2, amended D5-1) |
 | 4 | Integer paise end-to-end; canonical JSON refuses floats | floats never touch money; the refusal itself is a fuzz case | locked |

DEPLOY.md

@@ -23,11 +23,12 @@ on the site are live at all times, and one thing deliberately is not:
 - **The control room** polls the same state every few seconds: the ledger
   table, the filter tabs, the P&L meter, the chain verdict.
 
-What is not live by default: the payment rail (a loudly-labeled simulation
-until Razorpay **test** keys are set — the real Orders+Checkout+webhook path
-is implemented and `make spike-d1-1` proves it the moment keys exist) and
-the LLM brain (optional by design; the deterministic rules brain runs
-everything by default so demos replay bit-for-bit).
+Environment-sensitive: the payment rail runs Razorpay **test** mode when test
+keys are set (the real Orders+Checkout+webhook path — `make spike-d1-1` proves
+the mechanism); with no keys it degrades to a loudly-labeled in-process
+simulation, so a fresh deploy never pretends to move money. The LLM brain is
+optional by design; the deterministic rules brain runs everything by default
+so demos replay bit-for-bit.
 
 ## 1. Run it locally (60 seconds)
 

JUDGE.md

@@ -37,7 +37,7 @@ Evidence: `ARCHITECTURE.md` (the one diagram + decisions) · the two surfaces in
 one app: Playground (`src/components/customs/playground.tsx`) and Control Room
 (`src/components/customs/control-room.tsx`) · the **Why it exists** view
 (`src/components/customs/why.tsx`) states the problem and the unbuilt merchant
-half in plain words, with the architecture diagram and the honest scope ledger.
+half in plain words, with the architecture diagram and the desk ledger.
 
 ### 2 — Judgment on where AI genuinely helps
 Claim: mandate validation, bounds and price re-verification are deterministic
@@ -99,9 +99,9 @@ Deterministic values (fixed seed, fixed catalog, fixed clock) regenerate
 identically on any machine. Latency is machine-dependent and is therefore
 regenerated, never promised.
 
-## The honest scope ledger
+## The desk ledger
 
-- Reading surfaces: the Why view (problem, architecture diagram, scope ledger)
+- Reading surfaces: the Why view (problem, architecture diagram, desk ledger)
   and the Paper view + `PAPER.md` (protocol, economics, evaluation) ship in-app
   and in-repo; the paper's §5–§6 numbers are the live ledger's, never printed.
 - Live deployment: **https://customs.srivtx.xyz** — `/api/health` answers

Makefile

@@ -67,6 +67,7 @@ demo: ## one-command product demo
 	@echo "   Over the tier cap? 'attest' to escalate, then checkout."
 	@echo "   Red team: any 'attack: <id>' from the right rail."
 	@echo "   Control Room: approvals over ₹10,000, replay, ablation."
-	@echo "No keys needed — captures are labeled SIMULATED until Razorpay"
-	@echo "test keys are set in .env (see .env.example)."
+	@echo "Runs with no keys — captures fall back to a labeled SIMULATED"
+	@echo "rail; set Razorpay test keys in .env to clear on real test"
+	@echo "rails (see .env.example)."
 	@echo "───────────────────────────────────────────────────────────"

PAPER.md

@@ -175,10 +175,12 @@ failures, not just authored ones.
 
 ## §7 Limitations and future work
 
-The rail is a loudly-labeled simulation until Razorpay test-mode keys are
-configured; the Orders-plus-Checkout-plus-webhook path is implemented and the
-D1-1 spike script verifies it the moment keys exist, but live-key operation is
-out of scope by rule (live keys are refused at construction). The buyer agent
+The rail runs on Razorpay test-mode rails — the Orders-plus-Checkout-plus-
+webhook path, verified end to end by the D1-1 spike (`results/d1_1_spike.json`).
+With no keys configured — a fresh clone, a sandboxed runner — it degrades to a
+loudly-labeled in-process simulation, so nothing ever pretends to move money;
+live-key operation remains out of scope by rule (live keys are refused at
+construction). The buyer agent
 is in-house — no third-party agent has yet paid through the gate — and the
 MCP/ACP arms are protocol-shaped transports, honestly labeled, rather than
 certified implementations. The store is a single merchant with no tenancy or

README.md

@@ -90,9 +90,10 @@ make verify       # the exact evidence checks CI runs (zero deps)
 make test         # fuzz + ablation + audit + ledger-fork — exit codes propagate
 ```
 
-No keys required: the rail is an honestly-labeled simulation until Razorpay
-test keys are set in `.env` (see `.env.example`). Live keys are refused at
-construction. The LLM brain is optional too — set any one of
+Keys are optional: the rail runs Razorpay test mode when test keys are set in
+`.env` (see `.env.example`) — the live desk does; without keys it degrades to
+an honestly-labeled in-process simulation, so a fresh clone runs with zero
+setup. Live keys are refused at construction. The LLM brain is optional too — set any one of
 `OPENAI_API_KEY` / `GROQ_API_KEY` / `GEMINI_API_KEY` / `XAI_API_KEY` (Groq and
 Gemini have free tiers) plus `AGENT_BRAIN=llm`; without a key the
 deterministic rules brain runs everything, replayable.
@@ -174,7 +175,7 @@ the **Why it exists** view and `PAPER.md` §7.
 | `src/components/customs/landing.tsx` | overview: hero + bot, the live demo, ladder, proof layer |
 | `src/components/customs/demo-player.tsx` | the golden path, played live in code (what the README GIF records) |
 | `src/components/customs/hero-bot.tsx` | the customs bot — one smooth volume, token-inked, reduced-motion aware |
-| `src/components/customs/why.tsx` | why it exists + the architecture (drawn as cards) + scope ledger |
+| `src/components/customs/why.tsx` | why it exists + the architecture (drawn as cards) + desk ledger |
 | `src/components/customs/paper.tsx` | the working paper view — a clean document page, numbers live |
 | `src/components/customs/playground.tsx` | buyer side: chat, mandate approval, red team |
 | `src/components/customs/control-room.tsx` | merchant side: P&L, approvals, the order ledger |

VIDEO_TRANSCRIPT.md

@@ -93,16 +93,18 @@ Approve → gate checklist → capture.
 > was typed by a human. No link ships unless it works. And every bug we
 > ever hit became a test — forever."
 
-## 4:05–4:45 — what we have NOT done (honesty slide)
-
-**On screen:** the honest scope ledger, one card at a time.
-
-> "Now, what we have not done — said plainly. The payment rail runs in
-> clearly labeled simulation mode until Razorpay test keys are attached.
-> The code to flip it on is ready, and we already tested it against the
-> real API. The demo history comes from a fixed seed through the real
-> engine — no fake rows anywhere. Voice is for later. Every limit is
-> written on the screen, not hidden in a footnote."
+## 4:05–4:45 — labeled, and what's next (honesty slide)
+
+**On screen:** the desk ledger, one patch at a time.
+
+> "Now, how we label things — said plainly. The desk runs on real
+> Razorpay test-mode rails — test keys only, and the health endpoint
+> proves it on every boot. On a fresh clone with no keys, the rail
+> degrades to a clearly labeled simulation — nothing ever pretends to
+> move money. The demo history comes from a fixed seed through the real
+> engine — no fake rows anywhere. And the desk keeps its work order in
+> the open — the next four things we're building, on the same screen.
+> Every limit is written on the screen, not hidden in a footnote."
 
 ## 4:45–5:00 — close
 

llms.txt

@@ -35,7 +35,7 @@ Test mode only; without Razorpay keys the rail is a labeled simulation.
 - src/lib/customs/ledger/ — hash-chained JSONL audit trail (the database)
 - src/lib/customs/fuzz/corpus.ts — the 12 authored attacks, expected verdicts
 - src/lib/customs/meter.ts — channel P&L + projection, assumptions declared
-- src/components/customs/why.tsx — the why page: architecture drawn as cards + honest scope ledger (shipped / simulated / not yet)
+- src/components/customs/why.tsx — the why page: architecture drawn as cards + desk ledger (shipped / simulated / the work order for next)
 - src/components/customs/paper.tsx — the paper view: a clean theme-aware document page; §5–§6 numbers read live from the ledger
 - src/components/customs/demo-player.tsx — the landing demo: the golden path plays itself in code, loops (docs/demo.gif is a recording of it)
 - src/components/customs/hero-bot.tsx — the customs bot: one smooth animated volume on the hero, token-inked, reduced-motion aware
@@ -50,6 +50,7 @@ Latency is machine-dependent and never cited as a promise. Competitor numbers ne
 
 ## status
 
-Live deployment: pending (DEPLOY.md is the runbook). Payment rail: labeled
-simulation until Razorpay test keys are set (D1-1 spike ready). x402: declared
+Live deployment: https://customs.srivtx.xyz — /api/health answers ok:true on
+real Razorpay test rails (simulated:false). Payment rail: test mode when keys
+are set; labeled in-process simulation as the no-keys fallback. x402: declared
 stretch goal, not core scope.

src/components/customs/paper.tsx

@@ -320,10 +320,13 @@ export function PaperPage({ onEnter }: { onEnter: (v: View) => void }) {
         {/* §7 limitations */}
         <PaperSection n="7" title="Limitations and future work">
           <p>
-            The rail is a loudly-labeled simulation until Razorpay test-mode keys are
-            configured; the Orders-plus-Checkout-plus-webhook path is implemented and
-            the D1-1 spike script verifies it the moment keys exist, but live-key
-            operation is out of scope by rule (live keys are refused at construction).
+            The rail runs on Razorpay test-mode rails — the Orders-plus-Checkout-
+            plus-webhook path, verified end to end by the D1-1 spike
+            (`results/d1_1_spike.json`). With no keys configured — a fresh clone,
+            a sandboxed runner — it degrades to a loudly-labeled in-process
+            simulation, so nothing ever pretends to move money; live-key
+            operation remains out of scope by rule (live keys are refused at
+            construction).
             The buyer agent is in-house — no third-party agent has yet paid through the
             gate — and the MCP/ACP arms are protocol-shaped transports, honestly
             labeled, rather than certified implementations. The store is a single